Netrake Corporation

Audiocodes Ltd.

Audiocodes Texas, Inc.

Cyber Adapt, Inc.

James Robert Deerman

Robert Daniel Maher, Iii

Milton Andre Lie

Aswinkumar Vishanji Rana

Mark Warden Hervin

Travis Ernest Strother, Jr

John Raymond Carman

Larry Gene Maxwell

Ramanamurthy Dantu

Bill Joll

Keith Rhodes

Keung Chun Yue

Craig Lanning

A device and method for providing forensic data in network activity indicative of the presence of malware. A distributed set of network-based sensors operates within an enterprise network in cooperation with a centralized analytics and correlation engine that correlates detected events across the sensors to detect malicious activity on a monitored network which may include using a multi-tiered or Rete net rule set or engine. When malicious activity is detected upon the satisfaction of a predetermined set of conditions, the invention traces the activity to a host responsible for the activity for further action.

Device and method for detection of anomalous behavior in a computer network

An apparatus and method for traversing a network address translation/firewall device to maintain a registration between first and second devices separated by the firewall device are provided. In one example, the method includes intercepting a registration message from the first device to the second device. A determination is made based on a first timeout period defined by the second device as to whether it is time to renew the first device's registration. If it is time to renew the first device's registration, the registration message is forwarded to the second device. A response message that includes the first timeout period is intercepted, and the first timeout period is replaced with a second timeout period based on a binding lifetime of the firewall device before forwarding the response message to the first device.

Apparatus and method for firewall traversal

A method and system are described for resolving problems created by implementing multiple networks using private IP addresses and layer two tunneling protocols is described. A network processing system is operable to map flows from private IP addresses and ports on layer two tunneling protocol networks to public IP addresses and ports using the private IP addresses and ports and identifiers for the layer two tunneling protocol network. The network processing system uses its own public IP addresses and ports to anchor the traffic from the private network and performs the required mapping to pass traffic between the public and private networks.

Apparatus and method for mapping overlapping internet protocol addresses in layer two tunneling protocols

A network processing system is described that is able to monitor IP network traffic, including the ability to perform trap and trace on IP communications flowing over the IP network. The network processing system is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows, which allows the network processing system to search for predetermined search criteria contained within those flows. If a flow is found to contain a predetermined search criteria, the network processing system is able to maintain a record of the flow or to replicate the flow and save it or send it to another IP address for monitoring. The monitoring of a flow can include the entire contents of the flow, or any subset of information in the flow such as call identifying information.

Device for enabling trap and trace of internet protocol communications

A system and method for allowing bidirectional network traffic to pass through a network address translation ('NAT')/firewall device thereby allowing bidirectional traffic to flow between the private side of the NAT/firewall device and the public side of the NAT/firewall device while maintaining security between the public side and the private side is described. A network processing system on the public side of the NAT/firewall device anchors network traffic to and from the private side of the NAT/firewall device. A traversal client resides on the private side of the NAT/firewall device and has a secure connection with the network processing system. The traversal client is operable to pass signaling packets bound for a terminal on the private side of the NAT/firewall from the network processing system. The traversal client is also operable to send test packets through the NAT/firewall to create the allocations in the NAT/firewall to allow the bidirectional traffic to pass from the public side to the private side.

Apparatus and method for allowing peer-to-peer network traffic across enterprise firewalls

A network device for enforcing service level agreements is described that is able to scan the contents of entire data packets including header and payload information. The network device includes memory for storing subscriber information, policies and statistics. The traffic flow scanning processor scans the header and payload information from each data packet, which is used to associate each data packet with a particular subscriber, classify the type of network traffic in the data packet and to enforce the particular policies associated with the subscriber. The traffic flow scanning processor produces a treatment for the data packet based on the scanning. The scanned data packets and the associated treatments are then passed to a quality of service processor, which modifies the data packets if necessary and enforces resource allocation according to the preprogrammed policies.

Method and apparatus for enforcing service level agreements

A redundancy architecture is described for network processing systems which allows the network to recover from failure of a network processing system without interruption in service. The redundancy architecture allows network processing systems that use state information to associate network traffic into discrete flows, to provide system level redundancy to prevent service outages, or loss of network traffic resulting from a failure in any single network processing system. The redundancy architecture includes an out-of-band network link between the redundant network processing systems. The out-of-band network link allows the network processing systems to exchange state and other data as necessary. By maintaining the state data not only for the network traffic being processed by the network processing system, but also the state data for the network traffic being processed by its mate network processing system, either network processing system can assume the network traffic of its redundant mate in the event of a failure.

Redundancy scheme for network processing systems

A network processing system is described that is able to bind all the network traffic related to a bi-directional communication. Unidirectional processing engines take the data from line interfaces, and associate each data packet with an identifier, which identifies the flow of which the data packet is a part. The flows examined to determine if they are part of a bi-directional communication. If the flow is part of a bi-directional communication information related to the return flow or flows is extracted and passed to the unidirectional processing engine handling the flows in the opposite direction. This processing engine then pre-allocates resources in anticipation of the return flows. The pre-allocation of resources includes creating an entry in a session memory that contains state information on the flows passing through the network processing system.

Apparatus and method for using information in one direction of a bi-directional flow in a network to alter characteristics of the return direction flow

A network processing system is described that is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows. This ability allows the network processing system to learn characteristics of flows and events contained within those flows. Further, the network processing system can remember characteristics and events that have already been learned for use in processing future data packets. And finally, the network processing system can apply treatments to individual data packets and flows based on the characteristics and events learned, as well as previous state that has been maintained for that flow. To accomplish this, the network processing system includes processing engines, referred to as learning state machines, that scan the entire contents of data packets, use specific information in the data packets to associate the data packet with a particular session, or flow, identify characteristics of the data packet and associated flow, as well as events contained within the flow, store a state for the flow that contains the characteristics and events already learned, and determine a treatment for the data packet based on its contents and flow state.

Learning state machine for use in internet protocol networks

A network processing system is described that functions as a policy gateway in order to enforce programmable network policies designed to provide quality of service in and across networks. The programmable network policies are converted into an image load file using a management interface at a remote server, and sent to the network processing system where the image is loaded into a processing engine. The network processing system includes line interfaces to take the data from the network and to send processed data back onto the network. Unidirectional processing engines take the data from the line interfaces, and associate each data packet with an identifier, which identifies the flow of which the data packet is a part. The flows are then compared to the database of programmable network policies and the processing engine determines a treatment based on the results of the comparison. A quality of service processor in the processing engine then uses the treatment to modify and direct the data packets in a manner consistent with the network policies.

Growing community of inventors

Allen, TX, United States of America

James Robert Deerman